Exercise - Scope authentication methods and enable SSPR for Relecloud's engineering team

  • 12 minutes

Woodgrove Bank's security review deadline is approaching, and Relecloud's engineering team is first on the list. You've just learned the authentication method catalog and how scoping precedence works—now lock down the front door: scope a stronger method to the group, then enable self-service password reset with a two-method registration requirement.

Important

Prerequisites for this exercise:

  • A Microsoft 365 E5 tenant (or equivalent Microsoft Entra ID P1/P2 licensing) with Authentication Policy Administrator access.
  • A test security group representing the engineering team, with at least two test user accounts as members.
  • Access to the Microsoft Entra admin center at entra.microsoft.com.

If your lab tenant doesn't allow live SSPR testing with real phone numbers or authenticator apps, complete Task 1 and Task 2's configuration steps, then read through Task 3 to see how verification would play out.

Task 1: Scope Passkey (FIDO2) to the engineering team

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com with your Authentication Policy Administrator account.
  2. Select Protection > Authentication methods > Policies.
  3. Confirm Microsoft Authenticator is Enabled and targeted at All users—this is the default in new tenants and Relecloud's baseline for the whole workforce. If it's disabled or scoped narrower, enable it for All users first.
  4. Select Passkey (FIDO2), then select Enable.
  5. Under Include, add the engineering team's test security group. Leave All users untouched—passkey registration stays scoped to this group only.
  6. Under Exclude, leave empty unless you have a specific carve-out. Select Save.
  7. Confirm: the include/exclude scoping on each method's policy is independent—you've only changed Passkey (FIDO2)'s targeting, and Microsoft Authenticator's tenant-wide reach is unaffected.

Task 2: Enable SSPR with a two-method requirement

  1. Select Protection > Password reset > Properties.
  2. Set Self service password reset enabled to Selected, then add the same engineering team group.
  3. Select Authentication methods, set Number of methods required to reset to 2, and confirm at least two eligible methods are available (for example, Microsoft Authenticator and a phone number).
  4. Select Save.

Task 3: Verify which test users can and can't complete SSPR

  1. Have one test user who registered two authentication methods attempt SSPR at aka.ms/sspr. Confirm they can complete the reset—they meet the two-method requirement.
  2. Have a second test user who's only registered one method attempt the same reset. Confirm they're blocked or prompted to register an additional method first—one registered method isn't enough once the policy requires two.
  3. Reflect: SSPR enablement and the authentication methods policy work together. A user can be included in SSPR's scope and still fail to reset their password if they haven't registered enough methods to satisfy the requirement—that combination is exactly what Woodgrove's reviewers will ask about.

You've now scoped a stronger authentication method to Relecloud's engineering team and enabled SSPR with a real two-method requirement—two pieces of Woodgrove's front-door hardening, done.